Contact Tracing System
Monthly
Unrestricted file upload in SourceCodester Contact Tracing System 1.0 allows remote attackers to send a crafted file through the save handler at /classes/Users.php?f=save so that move_uploaded_file places attacker-controlled content into a web-accessible location, potentially yielding PHP code execution if the upload directory is executable. The provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, indicating no privileges or user interaction in the assessed scenario, though the endpoint's Users save context warrants source-level confirmation of pre-auth reachability, and impact is limited to version 1.0. Publicly available exploit code exists, but the supplied data does not confirm CISA KEV active exploitation.
Unrestricted file upload in SourceCodester Contact Tracing System 1.0 allows remote attackers to send a crafted file through the save handler at /classes/Users.php?f=save so that move_uploaded_file places attacker-controlled content into a web-accessible location, potentially yielding PHP code execution if the upload directory is executable. The provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, indicating no privileges or user interaction in the assessed scenario, though the endpoint's Users save context warrants source-level confirmation of pre-auth reachability, and impact is limited to version 1.0. Publicly available exploit code exists, but the supplied data does not confirm CISA KEV active exploitation.